Explanation:

The on-premises Active Directory domain is named contoso.com. To enable users to sign on using a different UPN (different domain), you need to add the domain to Microsoft 365 as a custom domain.

Explanation:
Assignments
Target resources
Access controls
Set Grant to Require authentication strength
The correct assignment area is Target resources because the policy must apply when users attempt to register or join devices. In Conditional Access, device registration and device join are handled as a user action under target resources, not as a network condition. Microsoft's Conditional Access deployment guidance explicitly lists the scenario "Require multifactor authentication for device join and device registration using user action," which confirms that the assignment must target the device-registration/join user action.
The correct access control is Set Grant to Require authentication strength. Plain "Require multifactor authentication" only requires any MFA method that satisfies the MFA claim, such as push notification, SMS, voice, or OATH. That does not guarantee phishing resistance. Microsoft documents that the Require authentication strength grant control lets administrators require a specific authentication strength in Conditional Access. Microsoft's built-in Phishing-resistant MFA strength includes methods such as FIDO2 security keys, Windows Hello for Business/platform credentials, and multifactor certificate-based authentication.
Therefore, the policy must target the device registration/join user action under Target resources and grant access only when the user satisfies the Phishing-resistant MFA authentication strength.

Explanation: